However, all this does is exactly that: hide the settings tab. It will not stop advanced users from changing the resolution, especially if you have a tray application or shell extension installed by your graphics card driver that allows users to do this.

Unless someone has a better method, I would add the AD group policy above, and uninstall or disable or otherwise lock down any Intel/ATI/NVidia application that allows users to change the resolution. This isn't bulletproof, but it should stop all but your most technical users.

As pointed out by others here, you can block users from accessing the Display Properties dialog box by using Group Policies.

But there's still a way of changing the resolution - the same way that's used by full-screen games. A simple program can temporarily change the resolution itself, Windows provides an API for that, and there already are a few such programs available on the internet that change the resolution on start, and restore it when they are closed.

So unless you somehow manage to patch the system internals, there's no way to completely prevent all users from changing the resolution if they want.